Threat Overview
Acronis Threat Research Unit published a detailed August 26 analysis of a multi-stage campaign targeting individuals and organizations in Cambodia. The chain uses DLL sideloading, encrypted payloads hidden in PNG-formatted files, process injection, persistence, Microsoft Defender exclusions, and a Bring Your Own Vulnerable Driver (BYOVD) technique before deploying SparkRAT.
The campaign installs ardrv.sys, an OPSWAT AppRemover driver affected by CVE-2026-36425, and uses the vulnerable driver to terminate security processes including Microsoft Defender components. It also creates a service and scheduled task named TaskHandler, injects into vssvc.exe, ctfmon.exe, and svchost.exe, and communicates with sx.nuihuw.com:443 with nuihuw.top:443 as backup. Acronis tracks the cluster as unattributed and states that SilverFox similarities are insufficient for attribution.
References
Impacted Systems
| Platform | Windows endpoints |
| Final payload | SparkRAT |
| Vulnerable driver | OPSWAT AppRemover ardrv.sys affected by CVE-2026-36425 |
| Persistence | Windows service and scheduled task named TaskHandler |
| Defense evasion | AMSI/ETW patching, Microsoft Defender exclusions, security-process termination via BYOVD |
| Process injection | Observed into vssvc.exe, ctfmon.exe, and svchost.exe |
| Observed C2 | sx.nuihuw.com:443; backup nuihuw.top:443 |
| Targeting observed | Cambodia-focused lures; broader scope not confirmed |
| Attribution | Unattributed cluster; SilverFox-like similarities are low-confidence assessment, not confirmed attribution |
What this hunt looks for
Looks for TaskHandler persistence, deployment of ardrv.sys, Defender exclusions, suspicious activity around vssvc.exe/ctfmon.exe, and connections to the reported SparkRAT C2 infrastructure.
Required logs
DeviceProcessEvents, DeviceFileEvents, DeviceRegistryEvents, and DeviceNetworkEvents.
First-Pass — TaskHandler Service or Scheduled Task Creation
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where FileName in~ ("sc.exe","schtasks.exe","cmd.exe")
| where ProcessCommandLine has "TaskHandler"
| where ProcessCommandLine has_any (@"C:\Drivers\mQm\F7u00ex.exe","create","ONSTART")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by TimeGenerated ascFollow-Up — ardrv.sys Vulnerable Driver Deployment
DeviceFileEvents
| where TimeGenerated >= ago(30d)
| where FileName =~ "ardrv.sys" or SHA256 == "7504887e1e195ad585cffa5b6a5034161a7cc49f351123d60def79302bdb8326"
| project TimeGenerated, DeviceName, ActionType, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| sort by TimeGenerated ascFollow-Up — Defender Exclusions Added Around Campaign Paths or Processes
DeviceRegistryEvents
| where TimeGenerated >= ago(30d)
| where RegistryKey has_any (@"\Microsoft\Windows Defender\Exclusions",@"\Windows Defender\Exclusions")
| where RegistryValueData has_any (@"C:\Drivers",@"C:\Windows\System32","VSSVC.exe","ctfmon.exe")
| project TimeGenerated, DeviceName, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessAccountName
| sort by TimeGenerated ascFollow-Up — Reported SparkRAT C2
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where RemoteUrl in~ ("sx.nuihuw.com","nuihuw.top") or RemoteUrl endswith ".nuihuw.com"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort, ActionType
| sort by TimeGenerated asc
Killian Sherer 